Executive brief
A logic error in the Pixel bootloader's permission checking code (remap.c) allows local attackers to bypass security restrictions and escalate privileges without needing special execution rights. This affects the low-level boot process that runs before the Android operating system starts, potentially allowing attackers to compromise device security from the ground up.
Technical details
The vulnerability is a permission bypass caused by a logic error in the enable_segment function of remap.c in the Google Pixel bootloader. It allows local escalation of privilege (EoP) with no additional execution privileges required, and user interaction is not needed for exploitation. The vulnerability is located in the bootloader component, which is part of the device firmware that executes before the kernel. Attackers who can execute code on the device can exploit this to gain higher privileges. A patch has been released as part of the 2026-09-05 security update.
Affected products
- Google Pixel Bootloader affected versions prior to 2026-09-05 patch level
Timeline
- 2026-09-15: disclosed: Published in Pixel Update Bulletin—September 2026
- 2026-09-05: patched: Security patch available as part of 2026-09-05 patch level